Security Scan Report: chipper-sawine-239128.netlify.app

Redirected to:
https://chipper-sawine-239128.netlify.app/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main domain is netlify.app and was registered 8 years ago.

Submitted URL: http://chipper-sawine-239128.netlify.app/

Effective URL:
https://chipper-sawine-239128.netlify.app/
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Fake Zimbra Web Client login on an anonymous netlify.app subdomain that sends entered usernames and passwords cross-origin to submit-form.com — a credential-phishing page impersonating Zimbra.

Risk Factors (4)
Brand impersonation of Zimbra on a non-Zimbra netlify.app subdomain
Credential-harvesting login form (username + password) submitted cross-origin to submit-form.com
IDS HIGH-severity alert for form exfiltration to submit-form.com
Anonymous shared-hosting subdomain with no reputation or legitimacy signals
Domain age information unavailable

Details

Page Title

Zimbra Web Client Sign In

Scan Type

public

Domain Name Analysis

The domain 'chipper-sawine-239128.netlify.app' uses the application-focused generic top-level domain (.app) with subdomain 'chipper-sawine-239128'. The core label 'netlify' covers 7 characters holding 2 vowels versus five consonants. Segmentation suggests 3 words: net, li, fy. The median word length lands at 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Em) Version; Default BG] what's This? Zimbra :: the leader in open source messaging and collaboration :: Blog - Wiki - Forums Copyright © 2005-2017 Synacor, Inc. All rights reserved. "Zimbra’ is a r...

Page Load Overview

12.06s
Total Load Time
21 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:923 chars
Detector Agreement:67%

Website Classification

Primary Category

forum community discussion48% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

forum community discussion
48%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
363.176.8.218Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
135.157.26.135Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
1201.76.128.133São Luís, Maranhão, Brazil
AS28652Telecomunicacoes Nordeste Ltda.
53--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T158522A1928D06C3041E305D8244BB698B9FE99739505880CF87EC3E95FF5FAA9253BBD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:HH7GvJtQJSqUhVL6OAhkWUT4OjYXhl2Ei0l0zxvRHFn:n7GvpWOAhkWUT4Oj6tTen

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:13396:YDNIHlkQs9eQTBkRWLAUAB6CJkhCGkNAJXQAkZ9AEKQIhUKIBGxxbMhlSBAlgCBBSJbQaloHA4NGlD4yJGI6IJgyIiBgCSB8

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7c3c3e7ffffe7
Perceptual Hash:b3a3cc8c33339966
Difference Hash:224d4d4d4d32040c
Wavelet Hash:ffe7e7c3c3270000
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data